[Bugfix] Revert the removal of winlog.event_data fields

[w0rk3r]

Proposed commit message

Revert the preserve_duplicate_custom_fields change from #14756 because it
causes unintended breaking changes to existing installations by removing
winlog.event_data fields that previously existed by default. As a secondary
effect, this leads to false positives in some detection rules that use those
fields as exclusions.

Summary

Revert the removal of winlog.event_data fields. These are used in detection rules because they’re more reliable and more likely to be populated correctly across different versions of the Windows and System integrations, as well as Winlogbeat.

Checklist

• I have reviewed tips for building integrations and this pull request is aligned with them.
• I have verified that all data streams collect metrics or logs.
• I have added an entry to my package's changelog.yml file.
• I have verified that Kibana version constraints are current according to guidelines.
• I have verified that any added dashboard complies with Kibana's Dashboard good practices

[andrewkroh]

LGTM assuming the CI goes 🍏 .

Thanks.

[elasticmachine]

Pinging @elastic/sec-windows-platform (Team:Security-Windows Platform)

[elastic-vault-github-plugin-prod]

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

[elasticmachine]

💚 Build Succeeded

• Buildkite Build
• Commit: 1e35b05

cc @w0rk3r

[elastic-sonarqube]

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube

[elastic-vault-github-plugin-prod]

Package system - 2.5.2 containing this change is available at https://epr.elastic.co/package/system/2.5.2/